Back to Database
Status published
Medium
CVE-2022-39358
Metabase vulnerable to circumvention of Locked parameter in Signed Embedding
Vulnerability Description
Metabase is data visualization software. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6, it was possible to circumvent locked parameters when requesting data for a question in an embedded dashboard by constructing a malicious request to the backend. This issue is patched in versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, and 1.42.6.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39358
Credits & Attribution
No credits recorded in the NVD database.
More from metabase
View All →CVE-2025-32382
Snowflake credentials logged by the Metabase backend
Low
1.8
CVE-2025-30371
Metabase vulnerable to circumvention of local link access protection in GeoJson endpoint
Low
2.1
CVE-2025-27141
Metabase Enterprise Edition allows cached questions to leak data to impersonated users
Medium
4.8
CVE-2024-55951
Metabase sandboxed users could see filter values from other sandboxed users
Medium
4.8
CVE-2023-37470
Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint
Critical
10
Affected Vendor
metabase
View all reports →Affected Software
metabase
Vulnerable Versions:
< 0.42.6, >= 0.43.0, < 0.43.7, >= 0.44.0, < 0.44.5, >= 1.0.0, < 1.42.6, >= 1.43.0, < 1.43.7, >= 1.44.0, < 1.44.5
Timeline
Official Publish:
October 26th, 2022
Last Modified:
April 23rd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N